PATENT APPLICATION 



RESPONSE UNDER 37 CFR §1.116 
EXPEDITED PROCEDURE 
TECHNOLOGY CENTER ART UNIT 2434 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 
In re the Application of 

Satoshi KONDO et al. Group Art Unit: 2434 

Application No.: 10/587,609 Examiner: M. RAHHM 

Filed: July 28, 2006 Docket No.: 128875 

For: SECURITY ENSURING BY PROGRAM ANALYSIS ON INFORMATION DEVICE 
AND TRANSMISSION PATH 

REQUEST FOR RECONSIDERATION AFTER FINAL REJECTION 

Commissioner for Patents 

P.O. Box 1450 

Alexandria, VA 22313-1450 

Sir: 

In reply to the July 13, 2009 Office Action, the shortened statutory period for reply 
being extended by the attached Petition for Extension of Time, reconsideration of the 
rejections is respectfully requested in light of the following remarks and the attached 
translation. 

Claims 7, 15 and 19-22 are pending. 
I. Faillenot Does Not Qualify As Prior Art 

The Office Action rejects claim 22 under 35 U.S.C. § 102(e) as being anticipated by 
U.S. Patent Application Publication No. 2006/010151 1 to Faillenot et al. ("Faillenot"). This 
rejection is improper because Faillenot does not qualify as prior art. 
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A. Faillenot Was Published After Applicants' PCT Date 

The present application is a National Stage of PCT/JP2005/002104 filed 
February 4, 2005. On the other hand, Faillenot was published on May 1 1 , 2006, after 
Applicant's PCT date. Thus, Faillenot does not qualify as prior art. In this regard, it is noted 
that the PCT filing date for Faillenot is not the effective filing date for Faillenot under 35 
U.S.C. § 102(e) because the PCT publication for Faillenot was not in English. Faillenot does 
not have a reference date that is earlier than Applicant's PCT date. 

Accordingly, disqualification of Faillenot as prior art under 35 U.S.C. § 102(e) is 
respectfully requested. As such, the rejection of claim 22 is rendered moot. 

B. The Submitted Translation Should Be Entered 

An accurate English-language translation of JP 2004-029928, the priority document of 
this application, is attached herewith. This translation perfects the priority date of this 
application to February 5, 2004 (the filing date of the priority document). This translation is 
not required to disqualify Faillenot as prior art under 35 U.S.C. § 102(e), and therefore does 
not require further consideration by the Examiner. In addition, any possible consideration, if 
needed, should have been foreseeable based on the prior claim for priority made in this 
application. Accordingly, entry of the translation of JP 2004-029928 is respectfully 
requested. 

II. Claims 7, 15 and 19-21 Define Patentable Subject Matter 

The Office Action rejects claims 7, 15 and 19-21 under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent No. 6,088,801 to Grecsek ("Grecsek") in view of U.S. Patent 
No. 7,123,914 to Matsubara et al. ("Matsubara"). This rejection is respectfully traversed. 

Flowcharts 1 and 2 are attached to facilitate understanding of the remarks below, and are 
not new matter. Flowchart 1 is derived from claim 7 and illustrates an overview of some of the 
functionality of claims 7 and 15. Flowchart 1 is merely intended to be an overview to contrast 
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the differences discussed below and does not constitute a simplification of, disclaimer of or 
prejudice to the subject matter of claims 7 and 15. Flowchart 2 is adapted from Fig. 3 of 
Grecsek to further describe the functionality disclosed in Grecsek. 

Claim 7 recites, among other features, "a storing unit that stores information on 
whether a function of a program provided via a network is permitted to be used; a receiving 
unit; a first receipt control unit that receives, using the receiving unit, before receiving a 
program via the network , function information indicating a function used in the program; a 
determining unit that determines whether to receive the program, by comparing function 
information received by the first receipt control unit and information stored by the storing 
unit; a second receipt control unit that receives, using the receiving unit, the program via the 
network if the determining unit determines to receive the program, and that cancels receipt of 
the program via the network if the determining unit determines not to receive the program." 
Claim 1 5 recites "a first step of receiving, before receiving a program via a network , function 
information indicating a function used in the program; a second step of determining, by 
comparing function information received in the first step and information on whether a 
function of a received program is permitted to be used, which is pre-registered in memory, 
whether to receive a program associated with the function information; a third step of 
receiving the program via the network if it is determined in the second step to receive the 
program; ... a fifth step of canceling reception of the program via the network if it is 
determined in the second step not to receive the program." 

The Office Action asserts that Grecsek discloses the above-quoted features. As shown 
in Flowchart 2, Grecsek discloses a computer 100 that, before executing software process 110, 
evaluates the process to create a capabilities list describing capabilities found in the process 110 
(step S21). Subsequently, the computer 100 reads a policy 200 and stores a capabilities list 210 
that specifies various functions and an authorizations list 220 that specifies whether each of the 
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capabilities described in the capabilities list 210 is acceptable (step S22). Subsequently, the 
computer 100 compares the capabilities list 210 created at step S21 and the policy 200 read at 
step S22 to determine whether each capability found in the process 110 violates the policy 200 
(step S23). The computer 100, if all of the capabilities found in the process 1 10 do not violate 
the policy 200 (step S23: NO), allows the execution of the process, and grants access to 
resources 130 (step S24). On the other hand, if either of the capabilities found in process 110 
violates the policy 200 (step S23; YES), the computer 100 denies access to resources 130 
accompanying the execution of the process (step S25). 

In contrast, Flowchart 1 depicts a different functionality. As depicted in Flowchart 1 , a 
receiving device, initially, before receiving a program, receives function information indicating 
a function used in the program (step SI 1). Subsequently, the receiving device compares the 
function information received at step SI 1 and information stored in a storing unit (step SI 2) to 
determine whether to receive the program (step SI 3). Claim 15 recites that the storing unit 
preregisters information (e.g., stores) on whether a function of a program provided via a 
network is permitted to be used. The receiving device, if determining to receive the program 
(step S 13: YES), receives the program via a network (step S 14). In this case, the receiving 
device executes the program, for example, in response to an instruction from a user (step SI 5). 
On the other hand, if determining not to receive the program (step S13: NO), the receiving 
device cancels receipt of the program (step SI 6). 

According to the above-recited features of claims 7 and 15, the receiving device receives 
function information indicating a function used in a program before receiving the program , and 
if determining that the program contains a function not permitted to be used, on the basis of the 
function information, does not receive the program . Thus, a result is achieved that a program 
containing a function not permitted to be used, e.g., a harmful program, is prevented from 
entering the receiving device. 
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In the Responses to Arguments section on page 2 of the Office Action, the Office Action 
asserts that Grecsek discloses this feature at col. 4, lines 14-19. Grecsek discloses that the 
authorizations 220 can be used to grant access or deny access to a process based on policy 200. 
Thus, Grecsek discloses evaluating process 110 before executing the process 1 10 to determine 
whether capabilities found in the process violate policy 200, and determining whether to allow 
execution of process 110 and access to resources 130 accompanying the execution of the 
process, on the basis of the capabilities found in the process, before executing the process. 

However, Grecsek does not disclose a configuration for determining whether to receive 
a program, or a configuration for receiving function information indicating a function used in 
the program, before receiving the program , to determine whether to receive the program. In 
other words, Grecsek fails to disclose the "first receipt control unit," the "determining unit" and 
the "second receipt control unit," as recited in claim 7. Likewise, Grecsek fails to disclose the 
first, second, third and fifth steps, as recited in claim 15. 

In Grecsek, evaluation of process 1 10 is made to create a capabilities list. A comparison 
of the capabilities list and predetermined policy 200 is made to determine whether the process 
violates policy 200. Accordingly, in Grecsek, unless process 1 10 is introduced into computer 
110, evaluation of the process cannot be made. In other words, in Grecsek, it is necessary to 
introduce process 110 into computer 100 to evaluate whether the process violates policy 200, 
even if the process is a process that violates policy 200 . In contrast, as recited in claims 7 and 
15, function information indicating a function used in a program, is received before receiving 
the program . If determining that the program contains a function not permitted to be used, e.g., 
a harmful program, the program is prevented from entering into the receiving device of claim 7, 
or prevented from being received in claim 1 5, so that higher security is achieved than can be 
achieved with the computer 100 of Grecsek. 
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In addition, in Grecsek, it is necessary to receive and install process 110, even if the 
process violates policy 200. In contrast, in claims 7 and 15, it is unnecessary to receive or install 
a program, if the program is problematic. In addition, memory resources to be used by a 
problematic program are prevented from being used. Also, by avoiding receipt of a problematic 
program, unnecessary communications charges or bandwidth usage can be avoided. Claims 7 
and 15 achieve at least these unexpected results as compared with computer 100 of Grecsek. 

Matusbara fails to cure at least these deficiencies of Grecsek. 

For at least the above reasons, Grecsek cannot reasonably be considered to teach, or to 
have rendered obvious, the combinations of features positively recited in independent 7 and 15. 
Further, as shown above, Matsubara is not applied in any manner that would overcome the 
above-identified shortfall in the application of Grecsek to the subject matter of independent 
claims 7 and 15. To any extent that Grecsek is even combinable with Matsubara, a conclusion 
which Applicants do not concede, no permissible combination of these references can 
reasonably be considered to have rendered obvious the combination of all of the features 
positively recited in claims 19-21, for at least the respective dependence of these claims directly 
on an allowable base claim, as well as the separately allowable subject matter that these claims 
recite. 

Accordingly, reconsideration and withdrawal of the rejections of claims 7, 15 and 19-21 
under 35 U.S.C. § 103(a) as being unpatentable over the applied references are respectfully 
requested. 

In view of the foregoing, it is respectfully submitted that this application is in condition 
for allowance. Favorable reconsideration and prompt allowance of claims 7, 15 and 19-22 are 
earnestly solicited. 
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Should the Examiner believe that anything further would be desirable in order to place 
this application in even better condition for allowance, the Examiner is invited to contact the 
undersigned at the telephone number set forth below. 

Respectfully submitted, 



JAO:JZS/ccs 

Attachments: 

Petition for Extension of Time 
English-Language Translation of JP 2004-029928 
Flowcharts 1 and 2 

Date: January 12, 2010 



James A. Oliff 
Registration No 




27,075 



Jarrett L. Silver 
Registration No 



60,239 



Oliff & Berridge, plc 

P.O. Box 320850 

Alexandria, Virginia 22320-4850 

Telephone: (703) 836-6400 



DEPOSIT ACCOUNT USE 
AUTHORIZATION 



Please grant any extension 
necessary for entry of this filing; 
Charge any fee due to our 
Deposit Account No. 15-0461 



-7- 



FLOWCHART 1 



c 



START 



Sll 



RECEIVE FUNCTION 
INFORMATION 



S12 



COMPARE RECEIVED 
FUNCTION INFORMATION AND 
STORED INFORMATION TO 
DETERMINE WHETHER TO 
RECEIVE PROGRAM 



S13 




S14 



S15 



RECEIVE PROGRAM? 





YES 


RECEIVE PROGRAM 






EXECUTE ] 


PROGRAM j 




NO 



S16 



CANCEL RECEIPT OF 
PROGRAM 



c 



END 



FLOWCHART 2 



c 



START 



S21 



J 



SEARCH FOR CAPABILITIES IN 
PROCESS 1 10 TO CREATE 
CAPABILITIES LIST 



S22 



I 



READ POLICY 200 
(CAPABILITIES LIST 210 AND 
AUTHORIZATIONS LIST 220) 



S23 




POLICY VIOLATIONS? 



S24 




YES 



NO 



GRANT ACCESS TO 
RESOURCES 130 



c 



S25 



DENY ACCESS TO 
RESOURCES 130 



END 



